Skip to main content

Findings

The Findings page lists all Security Hub CSPM findings stored in Prism, with multi-dimensional filters for narrowing to the findings that need attention. Click any row to open the Finding Detail drawer, where you can read full finding information and update the workflow status.

Accessing Findings​

Expand Security Hub CSPM in the sidebar and select Findings. The page header reads Findings, with the subtitle Security Hub CSPM findings followed by a count of the rows currently loaded.

The list loads 50 findings at a time, most recently observed first, whether or not any filter is active.

You can also reach the Findings page pre-filtered from other views. Each of these links carries the dashboard's own counting rule with it — compliance FAILED plus workflow NEW and NOTIFIED — so the list you land on is as long as the number you clicked, rather than also including passing checks and findings you have already suppressed or resolved. That is why the header reads Clear filters (3) or (4) the moment you arrive:

  • Click a severity card on the Compliance Dashboard to open Findings filtered to that severity, plus the counting rule
  • Click an account row in the "Assets with most findings" table to open Findings filtered to that account, plus the counting rule
  • Click View failing findings on a Standard Detail view to open Findings scoped to that standard, plus the counting rule
  • Click a check row on the Control Detail view to open the Finding Detail drawer for that specific finding

Clearing the filters widens the list past what the dashboard counted, so the totals will no longer match.

info

Findings are served from the last local refresh, not from live AWS. Results reflect the state at the time the most recent Refresh findings job completed. Run a new refresh from the Compliance Dashboard to pull the latest findings from AWS.

note

This page lists Security Hub control findings, the pass/fail results produced by the standards you enabled. Findings that other AWS services forward into Security Hub (GuardDuty, Macie, Inspector) are excluded here so the same finding is not reported twice; each of those engines has its own findings page.

Findings Table​

The findings table displays the following columns:

ColumnDescription
SeverityA colored chip showing the ASFF severity label: CRITICAL, HIGH, MEDIUM, LOW, or INFORMATIONAL
TitleThe finding title describing the control or check that failed. Long titles are truncated; hover to see the full text
Resource typeThe type of AWS resource affected, as Security Hub reports it (for example AwsS3Bucket). The resource's own ARN or ID is not in this column; it is in the detail drawer
AccountThe AWS account ID where the resource lives
RegionThe AWS region where the resource was observed
WorkflowA chip showing the current workflow status: NEW, NOTIFIED, SUPPRESSED, or RESOLVED
Last observedThe date and time the finding was last observed in AWS Security Hub, in your browser's local format

Rows are ordered by last-observed time, newest first.

Click any row to open the Finding Detail drawer for that finding.

Filtering​

A Filters card sits above the results, subtitled "Narrow the list by account, severity or status". When at least one filter is active the card header shows an N active chip, and a Clear filters (N) button appears in the page header; click it to reset every filter at once.

The card offers:

  • Account: a dropdown of the accounts currently enrolled in CSPM, each labelled Name (123456789012), or just the ID where Prism has no name for it. Accounts that have been removed, or are being removed, are left out. Type in the field to narrow the list; the placeholder is "All accounts". The options are loaded separately from the findings themselves, so if that list cannot be fetched the dropdown is empty even though the findings below are fine
  • Search title: type any text to filter findings whose title contains that substring
  • Severity chips: toggle one or more of CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL
  • Workflow status chips: toggle one or more of NEW, NOTIFIED, SUPPRESSED, RESOLVED
  • Compliance status chips: toggle one or more of FAILED, PASSED, WARNING, NOT_AVAILABLE

Selecting several chips within one group matches any of them; separate groups combine to narrow the result.

Standard Filter​

The list also honours a standard URL parameter — set by the View failing findings button on a Standard Detail view, and settable by hand. When it is present, a removable chip reading Standard: {standard name} appears between the Account/Search row and the chip groups, and only findings associated with that standard are listed. Click the chip's delete icon to clear it. There is no dropdown for this filter, and no equivalent filter for a single control.

Results Count​

The page header and the results card — headed Results — both report how many rows are currently loaded, as "N shown". A trailing + (for example "50+ shown") means more findings match the filters than have been loaded so far. The count is the number of rows on screen, not a total: it grows each time you click Load more.

Pagination​

The findings table loads 50 findings at a time. If more findings match the active filters, a Load more button appears below the table. Click it to append the next page to the existing list; the button reads Loading… and is disabled while that page is in flight. Changing any filter clears the list and reloads from the first page.

Empty States​

The table shows one of two empty states, and they mean different things:

  • No findings match these filters, with "Clear a filter or widen the search to see more findings.", appears when at least one filter is active. The store has findings; none of them match
  • No findings yet, with "Findings appear here as soon as your enrolled accounts report them.", appears when no filter is active. Nothing has been ingested for this tenant yet, usually because no refresh has completed or AWS has not finished evaluating your accounts

Finding Detail​

Clicking any findings row opens the Finding Detail drawer, which slides in from the right side of the screen. The drawer shows full information for that finding and lets you update its workflow status.

Opening Finding Detail​

Click any row in the findings table, or click a check row in the Control Detail view.

Drawer Header​

The drawer header shows:

  • Title: the full finding title
  • Severity chip: color-coded by severity level
  • Workflow status chip: the current workflow status (NEW / NOTIFIED / SUPPRESSED / RESOLVED)

A close (×) button sits at the top right of the header.

Finding Details Section​

The Finding details section opens with the finding description, a full explanation of what the check evaluates, followed by:

FieldDescription
Finding IDThe AWS finding identifier, which is also the key Prism caches the finding under
AccountThe AWS account ID where the resource lives
RegionThe AWS region where the resource was observed
First observedDate and time the finding was first observed in AWS Security Hub
Last observedDate and time the finding was last observed in AWS Security Hub

A field with no value is omitted rather than shown blank. Observation times AWS never stamped are treated as absent, so First observed and Last observed can be missing on such findings.

Resource Section​

FieldDescription
Resource typeThe AWS resource type, as Security Hub reports it (for example AwsS3Bucket)
ResourceThe specific AWS resource ARN or identifier affected by this finding

Compliance Section​

When the finding carries a compliance status, a Compliance section shows it as a single chip, title-cased: Failed (red), Passed (green), Warning (amber), or Not Available (neutral grey). The section is omitted entirely for a finding with no compliance status.

Standards Section​

When the finding is associated with one or more compliance standards, a Standards section shows a chip for each standard by display name (for example "PCI DSS v4.0.1").

Remediation Section​

When remediation guidance is present in the finding's ASFF payload, a Remediation section appears with:

  • The recommendation text AWS supplies for this control
  • A View documentation link, shown only when the payload also carries a URL. It opens the AWS remediation page for the control in a new tab
note

The Remediation section is absent for any finding whose AWS payload does not include a remediation recommendation; Prism does not synthesize one.

Updating Workflow Status​

CSPM is the only Security Hub engine whose findings Prism can change, so the drawer footer carries a workflow form:

  1. Select a new status from the Workflow status dropdown: NEW, NOTIFIED, SUPPRESSED, or RESOLVED. It opens on the finding's current status.
  2. Optionally fill in Note (optional) describing the reason for the change.
  3. Click Update workflow to save. The button reads Saving… while the request is in flight. Close dismisses the drawer without saving.

Prism sends the change to AWS Security Hub first and updates its own copy only if AWS accepts it, so the two cannot drift apart on a failed call. A note, when you provide one, is written to the finding in Security Hub and attributed to prism-portal. After a successful save the drawer closes and the findings list reloads from the first page; if the call fails the drawer stays open and shows the error.